Continuous-variable quantum key distribution protocols over noisy channels 
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A continuous- variable quantum key distribution protocol based on squeezed states and heterodyne 
detection is introduced and shown to attain higher secret key rates over a noisy line than any 
other one-way Gaussian protocol. This increased resistance to channel noise can be understood 
as resulting from purposely adding noise to the signal that is converted into the secret key. This 
notion of noise-enhanced tolerance to noise also provides a better physical insight into the poorly 
understood discrepancies between the previously defined families of Gaussian protocols. 
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Quantum Key Distribution (QKD) is a prominent ap- 
plication of quantum information sciences, enabling two 
partners (Alice and Bob) to share a secret key, which in 
turn allows them to communicate with full security. A 
particular class of QKD protocols based on the Gaussian 
modulation of Gaussian states has attracted much atten- 
tion over the last years for its associated (homodyne or 
heterodyne) detection scheme offers the prospect of very 
high key rates In these so-called continuous- variable 
(CV) protocols, the data which make the key are encoded 
into continuous-spectrum quantum observables, namely 
the quadrature components of a light field. These proto- 
cols fall to date into three families, depending on which 
states and detection schemes are used. 

In the first one, Alice uses a source of squeezed states 
that are randomly displaced along the squeezed quadra- 
ture, while Bob performs homodyne detection [2]. The 
experimental implementation is much simplified with the 
second one, which is based at Alice's side on coherent 
states modulated in both quadratures instead of squeezed 
states modulated along a single quadrature Q. This 
second proposal was first demonstrated experimentally 
in Ref. [4], while its implementation with optical tele- 
com components was reported in Ref. 0. In the third 
proposal, Alice still uses coherent states but Bob per- 
forms heterodyne instead of homodyne detection, mea- 
suring both quadratures together, hence eliminating the 
need for an active random basis choice [(|. 

In this Letter, we introduce a fourth CV-QKD pro- 
tocol based on squeezed states and heterodyne detection, 
which, surprisingly, happens to outperform all previous 
Gaussian protocols when the noise level in the quantum 
channel is high. This hitherto overlooked protocol, com- 
pleting the family of Gaussian protocols, had not been 
found earlier because, at first sight, it serves no purpose 
measuring both quadratures when only one of them (the 
squeezed quadrature) carries the key. This striking effect 
can, however, be understood by exploring the analogy 
with qubit-based QKD and realizing that adding some 
noise on the data of the appropriate partner during the 
error correction phase may result in an increase of the 
secret key rate pj. We indeed can explain the improved 



resistance to noise of our new protocol by using its equiv- 
alence with the first protocol, based on squeezed states 
and homodyne measurement, supplemented with noisy 
post-processing. This analysis also allows us to construct 
the family of optimal Gaussian protocols with respect to 
channel excess noise. 

It has been known after Ref. 0| that the performance 
of qubit-based QKD protocols can be increased by having 
Alice adding some noise to her data in the error correc- 
tion phase. This additional classical noise makes the pro- 
tocol more robust against noise in the quantum channel 
because it is more detrimental to Eve than to Bob. More 
precisely, for each quantum channel, there is an optimal 
level of noise that Alice should add in order to maximize 
the secret key rate. An explanation of this phenomena 
can be found in Ref. Q using an entanglement-based 
description of BB84 together with a modified version 
of Shor-PreskilPs unconditional security proof Q. Note 
that entangled-based_CV-QKD protocols have also been 
introduced in Ref. [lfj, but entanglement will only be 
used in what follows as a tool to analyze all four prepare- 
and-measure protocols on a same footing. We shall show 
that this counterintuitive effect also appears, though in 
disguise, in the case of CV-QKD protocols. This is not 
straightforward, however, because of the distinction that 
exists between direct reconciliation (DR) and reverse rec- 
onciliation (RR), a feature which plays a central role in 
CV-QKD. In contrast to qubit-based QKD, it is indeed 
crucial to specify whether Alice or Bob is the reference 
during the error correction post-processing phase. In DR, 
Alice plays this role and the maximal achievable range is 
known to be 3dB 0] jin RR, there is no theoretical limi- 
tation to this range [4|. 

In the following, we will focus on the security of CV- 
QKD against collective attacks, where Eve interacts in- 
dividually with each signal pulse sent by Alice but ap- 
plies a joint measurement at the end of the classical 
post-processing stage. Studying this class of attacks is 
sufficient to prove unconditional security of qubit-based 
QKD protocols Uj, and we take for granted here the 
conjecture that the same holds for CV-QKD In 
addition, we restrict our study to Gaussian collective at- 



tacks as they are known to be optimal [121 ] . Furthermore, 
we consider RR as it works over longer distances. The 
corollary is that Alice and Bob's roles must be inter- 
changed when analyzing the tolerance to noise (indeed, 
qubit-based QKD uses DR). This leads us to introduce a 
fourth Gaussian protocol. 

The protocol. The first stage consists in quantum com- 
munication over the quantum channel, characterized by 
the transmittivity T and added noise variance referred 
to the input xc- Alice generates a random bit r and a 
real number a drawn from a Gaussian distribution G(a) 
of variance V a . Subsequently, she generates a squeezed 
vacuum state of covariance matrix diag(l/V, V) and dis- 
places it by an amount (a, 0), see Fig. [TJ Before send- 
ing the state together with the local oscillator through 
the quantum channel, she applies a random dephasing of 
9 = r7r/2 to the state. This dephasing is equivalent to 
randomly choosing to squeeze and displace either the x or 
p quadrature, as in Ref. 0]. Averaging the output states 
over G(a) gives the same (thermal) state for r = and 
r = 1, which prevents Eve from extracting information 
on which quadrature was selected by Alice. This imposes 
the constraint V a + 1/V — V on Alice's modulation. The 
quantum signal and local oscillator can be transmitted 
over the same fiber by using a time multiplexing tech- 
nique, as in Ref. [l3(. At Bob's station, the signal is first 
demultiplexed and subsequently measured by a standard 
heterodyne measurement, as shown in Fig. [TJ The use 
of heterodyning makes the random number generator on 
Bob's side unnecessary since there is no need to switch 
between the measurements of conjugated bases, just as 
in Ref. After repeating these steps many times, Al- 
ice ends up with a long string of data a correlated with 
Bob's heterodyne data (b x ,b p ). 

The second stage is the classical post-processing stage, 
which serves extracting the secret key. It starts by Al- 
ice revealing the string of random bits r encoding her 
chosen quadratures and Bob keeping as his final string 
of data b the measurements (b x or b p ) matching Alice's 
choices. This step is followed by the channel estimation, 
where Alice and Bob reveal a fraction of their data in 
order to estimate T and xc, which allows them to bound 
Eve's information. Subsequently, Alice and Bob apply a 
RR algorithm, such as LDPC codes [13j combined with 
a discretization operation. This operation outputs two 
perfectly correlated binary strings. Finally, both part- 
ners apply a privacy amplification algorithm based, e.g., 
on hash functions [131 ]. which produces a shared binary 
secret key from their perfectly correlated data. As shown 
in Ref. [7[, the achievable RR secret key rate reads 

K = I{a:b) — S(b:E), (1) 

where I{a:b) is the Shannon information between Al- 
ice and Bob's data while S(b:E) is Eve's information 
on b given by the Holevo quantity S(b:E) = S(pe) — 
J db p(b)S(p b E ). Given that Eve can be assumed to hold 
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FIG. 1: Proposed experimental implementation of the new 
protocol. The source (Alice) is based on a master laser beam. 
A fraction of it is extracted to make the local oscillator (LO) , 
while the rest is converted into second harmonic in a non- 
linear crystal (SHG). After spectral filtering (Fi), the second 
harmonic beam pumps an optical parametric amplifier (OPA) 
which generates a squeezed vacuum state. Following the fil- 
tering of the second harmonic (F2), this squeezed state is 
displaced by a. This is done by mixing the state on a beam- 
splitter of high transmittivity (Tht ~ 99% for BSht) with 
a coherent state of intensity a 2 /(I — Tht), extracted from 
the LO. The attenuation (A) thus depends on a, which is dis- 
tributed according to a Gaussian distribution G(a) of variance 
V a - Before time multiplexing (M) the quantum signal with 
the LO, Alice applies a phase shift 6 — rn/2 to it depend- 
ing on the value of the random bit r. Then, the two com- 
ponents of the time multiplexed signal travel to Bob through 
the same fiber, thereby avoiding a spurious dephasing between 
the signal and LO. At Bob's station, the two components are 
demultiplexed (M'), and the quantum signal is heterodyne 
measured. The latter measurement consists in splitting the 
quantum signal (and LO) in two with the balanced beamsplit- 
ters (BSb), and then homodyning each beam. The LO used 
in the second measurement is dephased by 7r/2 in order to 
measure the conjugate quadrature. Each homodyne detector 
is composed of a balanced beam splitter and a pair of highly 
efficient photodiodes; the difference of the photocurrents gives 
the quadratures b x and b p . 

the purification of the system and that Gaussian attacks 
are optimal, we can directly compute K from the covari- 
ance matrix jab inferred from the channel estimation. 

Tolerance to noise. In Fig. [2] a), we show that this 
new protocol performs better than all previous RR pro- 
tocols in term of tolerable excess noise, i.e., the lowest 
e = xc — (1 — T)/T that gives a zero secret key rate. In 
realistic implementations of CV-QKD, the excess noise 
generally comes from the laser's phase noise and imper- 
fections in the modulation, as discussed in Ref. so 
that it can be considered as approximately independent 
of the length of the fiber. This does not mean, however, 
that the new protocol gives higher rates regardless of the 
channel transmittivity. As shown in Fig. [2] b) , it is only 
for losses higher than a given threshold that it gives a 
higher secret key rate than the protocol of Ref. [2| . 

In the new protocol, Bob disregards either b x or b p 
during the post-processing stage, depending on Alice's 
quadrature choice r. This is equivalent to tracing out 
the mode that is not used in Bob's heterodyne measure- 
ment, so that the new protocol can be viewed as a noisy 
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FIG. 2: a) Tolerable excess noise e (in shot-noise units) as 
a function of the channel losses (in dB) for RR protocols: 
new (solid line), squeezed states and homodyning (dashed 
line) Q, coherent states and homodyning (dotted line) [!|, 
coherent states and heterodyning protocol (dash-dotted line) 
[f|. The optimal protocol with Bob's added noise \d is also 
shown (crosses). The curves are plotted for V — > oo. b) Secret 
key rates as a function of the channel losses (in dB) for RR 
protocols: new (solid line), squeezed states and homodyning 
protocol (dashed line) Q|. The curves are plotted for an excess 
noise e = 0.5 and V = 40. 



version of the protocol based on squeezed states and ho- 
modyne measurement [2J where Bob inserts a balanced 
beamsplitter before his measurement. The losses induced 
by this beamsplitter translate into noise once Bob clas- 
sically amplifies his outcome to match the initial signal. 
Therefore, we have a clear demonstration that adding 
noise that is not controlled by Eve on Bob's side can be 
beneficial in CV-QKD for a RR protocol. 

Interestingly, this effect has a counterpart in DR which 
remained unnoticed to date although it is visible with 
known protocols. We indeed observe in Ref. [l4[ that the 
homodyne protocol based on coherent states gives a bet- 
ter tolerance to excess noise in DR than that based on 
squeezed states. The reason is that the former protocol 
[3j can actually be viewed as a noisy version of the latter 
protocol 0, where the noise is now added by the same 
mechanism but on Alice's side in the entanglement-based 
equivalent scheme, see Fig. [3] In this scheme, coher- 
ent states are prepared by Alice applying an heterodyne 
measurement, which can be viewed as a noisy homodyne 
measurement. We thus conclude that there is a benefi- 
cial effect of noise if added on the reference side of error 
correction (Alice in DR and Bob in RR). Clearly, adding 
noise on the other side is always detrimental as it de- 
creases the information between the authorized parties 
without affecting the eavesdropper's information. 

Optimal protocol. We now generalize the above new 
RR protocol to optimally resist against an arbitrary 
channel noise. In Figure 03 we exhibit an entanglement- 
based description of CV-QKD protocols, where Bob 
replaces his heterodyne measurement by an ideal ho- 
modyne measurement preceeded by a general Gaussian 
phase-insensitive added noise. This models the follow- 



FIG. 3: Entanglement-based description of the protocol with 
general Gaussian added noise on Bob's side. The source of 
squeezed states on Alice's side is replaced by an entangled 
pair (EPR) of variance V, followed by an homodyne mea- 
surement of mode A. The other mode is sent to Bob through 
the quantum channel. Before Bob's homodyne detection, the 
state received by Bob is mixed with a thermal state (half of an 
EPR pair) of variance iV on a beamsplitter of transmittivity 
Tb( Xd = (1 -T B )N/T B ). 



ing physical situations: i) inefficient homodyne detec- 
tion with efficiency Tg and electronic noise variance 
v = (1 — Tb)(N — 1); ii) perfect homodyne detection 
followed by a classical Gaussian added noise of variance 
Xd = (1 — Tb)N/Tb; iii) any combination of the pre- 
vious cases giving the same \d- The secret key rate 
can be calculated using the following technique. First 
we use the fact that Eve's system E purifies AB, that 
is, S(E) = S(AB). Secondly, after Bob's projective 
measurement yielding 6, the system AEFG being pure, 
we have S(E\b) = S(AFG\b). For Gaussian states 
S(AFG\b) is the same for all b's, being just a function of 
the covariance matrix jab- Thus, we obtain, 

K = I(a:b) - S(AB) + S(AFG\b) (2) 

which can be calculated from the covariance matrix 



JAB 



xl za 
za yl 



(3) 



where x = V, y = T(V + Xc), z = ^T{V 2 - 1), I = 
diag(l, 1) and a = diag(l, —1). The information between 
Alice and Bob reads 



1 



I(a:b) = -log 



V + X 

x + Vv 



(4) 



where x — Xc + Xd/T. Then, S(AB) is a function of the 
symplectic eigenvalues Ai,2 of jab which reads 



S(AB) = G[(Ax - l)/2] + G[(A 2 - l)/2], 



(5) 



where G{x) = (x + 1) log(a; + 1) — x log x is the von Neu- 
mann entropy of a thermal state and 
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Here, we have used the notation A 
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Finally, S(AFG\b) is a function of the 
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FIG. 4: a) Optimal secret key rates as a function of the chan- 
nel losses (dB) for a fixed excess noise e = 0.5 (solid line) 
compared to the protocol based on squeezed states and ho- 
modyning 0] (dotted line) and the new protocol proposed in 
this Letter (dashed line), b) Optimal choice of \d (in shot- 
noise units) that maximizes the secret key rate. The curves 
are plotted for V = 40. 



similar to ([5]) where A 3 4 



symplectic eigenvalues A3,4 
solutions of the second order polynomial A 4 
with 



A = 



1 



■[y + xD + x D A] 



y + XD 

B = -B—[ X + XD D\. 

y + XD L 



are 

AX 2 +B = 



(7) 
(8) 



By tuning Bob's added noise \d, it is possible to maxi- 
mize the secret key rate, as shown in Fig. 01 More impor- 
tantly, the resulting family of optimal protocols exhibits 
the highest tolerance to noise among all Gaussian CV- 
QKD protocols, as demonstrated in Fig. [2] a) (crosses). 

Note that although Bob's heterodyne measurement is 
useful to get an insight on this enhanced tolerance to 
noise, Bob eventually disregards one of the two quadra- 
tures in the actual protocol. Thus, up to a factor of two in 
the key rate, he may as well apply a (noisy) homodyne 
measurement and keep the outcome only when he has 
measured the right quadrature. Finally, instead of using 
a random numbers generator to generate the noise xd, it 
is certainly more interesting for Bob to do it physically 
by tuning the efficiency of his detector. 

Conclusion. We have proposed a new CV-QKD pro- 
tocol using squeezed states and heterodyne detection, 
which outperforms all known Gaussian protocols in terms 
of resistance to noise. This enhanced robustness can be 
interpreted as the continuous- variable counterpart of the 



effect, first described in Ref. Q, that adding noise in 
the error-correction post-processing phase may increase 
the secret key rate of one-way qubit-based protocols. 
Then, we have studied the impact of a general Gaussian 
phase-insensitive noise on the secret key rate, and have 
shown that for each quantum channel (characterized by 
its transmittivity T and added noise variance xc), there 
is an optimal noise xd that Bob must add to maximize 
the secret key rate. The resulting protocol also exhibits 
the highest resistance to noise among all Gaussian pro- 
tocols. This noise-enhanced tolerance to noise is par- 
ticularly interesting for reverse-reconciliation CV-QKD 
protocols, which work over larger distances, but, inter- 
estingly, it also has an analogue for direct-reconciliation 
protocols. This gives a physical explanation to the previ- 
ously observed - but poorly understood - discrepancies 
between the efficiencies of Gaussian protocols. 
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